Forgot Your Linux Root Password? How to Reset It (2026 Guide)
If you've lost your server's root password and haven't set up key-based login, you can no longer get in over SSH. But as long as you can access the server's console, you can reset the password during boot. This guide covers three common methods: using rd.break in GRUB (RHEL family), init=/bin/bash (works everywhere), and mounting the disk from rescue mode. All of them let you regain access without reinstalling the OS or losing data.
Key Takeaways
- If you forget your Linux root password, you can reset it during boot as long as you have access to the server console, without reinstalling the OS or losing websites, databases or other business data.
- On RHEL-family systems such as Rocky Linux 9 and AlmaLinux 9, the recommended way to reset the root password is appending
rd.breakin GRUB, and runningtouch /.autorelabelis essential so SELinux relabels file contexts. - On Ubuntu 22.04/24.04 and Debian 12, the recommended way is appending
init=/bin/bashto the GRUBlinuxline and then resetting the password withpasswd root. - When GRUB is password-protected or its menu isn't visible in VNC, you can boot a rescue system, mount the original root partition and change the root password via
chroot. - IMIDC cloud VPS plans let you open a VNC console from the product details page in the Client Center for this kind of emergency recovery, while remote control or rescue needs on IMIDC dedicated servers are handled through a support ticket.
Who This Is For / Prerequisites
- OS: Rocky Linux 9, AlmaLinux 9 (
rd.breakrecommended); Ubuntu 22.04/24.04, Debian 12 (init=/bin/bashrecommended). Older systems such as CentOS 7 also supportrd.break. - Console access: open the VNC console from the product details page in the IMIDC Client Center. Dedicated servers may require IPMI/KVM; if your product doesn't provide it or you're not sure, submit a ticket and our staff will help.
- The disk is not encrypted (LUKS-encrypted disks require entering the passphrase first).
- Before you start, we recommend creating a snapshot in the Client Center or confirming you have a backup (if your product supports it).
Steps
Step 1: Reboot via VNC and Enter the GRUB Menu
In the VNC console, send Ctrl+Alt+Del, or reboot from the Client Center. As soon as the GRUB boot menu appears, press an arrow key to stop the countdown. Ubuntu hides the menu by default; hold Shift during boot (BIOS) or press Esc repeatedly (UEFI) to bring it up.
Select the default kernel, press e to enter edit mode, and find the line that starts with linux (on RHEL-family systems it may be linux or linuxefi).
Step 2A: Rocky / AlmaLinux — Use rd.break
Append rd.break to the end of the linux line. If there's a serial console parameter such as console=ttyS0 and VNC shows no output, remove it. Press Ctrl+X to boot. At the switch_root:/# prompt, run:
mount -o remount,rw /sysroot
chroot /sysroot
passwd root
touch /.autorelabel
exit
exit
touch /.autorelabel is essential: it tells SELinux to relabel file contexts on the next boot. Without it, you may be unable to log in because /etc/shadow has the wrong label. Relabeling takes a few minutes, and the system will reboot once more automatically, so please be patient.
Step 2B: Ubuntu / Debian — Use init=/bin/bash
On the linux line, change ro to rw, remove quiet splash, and append init=/bin/bash to the end. Press Ctrl+X or F10 to boot. At the root@(none):/# prompt, run:
mount -o remount,rw /
passwd root
sync
exec /sbin/init
In this mode systemd isn't running, so the normal reboot command won't work; use exec /sbin/init to continue a normal boot instead. If the system hangs, you can force a reboot in VNC with echo b > /proc/sysrq-trigger (be sure to run sync first).
Tip:
init=/bin/bashalso works on RHEL-family systems, but you still needtouch /.autorelabelafterwards.
Step 3: Rescue Mode (When You Can't Edit GRUB)
If GRUB is password-protected or the menu isn't visible in VNC, use the rescue system. If the Client Center doesn't offer a rescue mode option, submit a ticket to request a rescue ISO be mounted. Once in the rescue system:
lsblk -f # Find the original root partition, e.g. /dev/vda1
mount /dev/vda1 /mnt
# If the root partition is on LVM, run vgchange -ay first, then mount /dev/mapper/xxx-root
for d in dev proc sys; do mount --bind /$d /mnt/$d; done
chroot /mnt passwd root
touch /mnt/.autorelabel # Only needed on SELinux systems (Rocky/Alma)
umount -R /mnt
reboot
Step 4: Verify Login and Clean Up
Log in over SSH with the new password. If you still get Permission denied, check whether root password login is disabled in /etc/ssh/sshd_config.d/. In that case, log in through VNC and set up an SSH key instead. Once the reset is done, we recommend configuring key-based authentication right away and storing the password in a password manager.
FAQ
Will resetting the root password delete any data on my server?
No. These methods only change the password hash in /etc/shadow and don't touch your websites, databases or other business data. However, working in the console carries a risk of human error, so back up beforehand.
I changed the password on Rocky Linux but still can't log in?
The most common cause is forgetting touch /.autorelabel, so SELinux refuses to read the new shadow file. Boot into rd.break again and run that command.
Can I reset the root password directly from the Client Center?
Some cloud products may support online resets, but this depends on the agent in the image and the product type. Check what's actually available on the product details page in the IMIDC Client Center. If there's no such option, follow this guide manually or submit a ticket.
What if keyboard input is garbled in the VNC console?
The keyboard layout may not match. Avoid special characters and set a simple temporary password first, then log in over SSH and use passwd to change it to a strong one.
Summary
As long as you have console access, a forgotten root password doesn't require a reinstall: on RHEL-family systems use rd.break and remember to trigger an SELinux relabel; on Debian/Ubuntu use init=/bin/bash; and fall back to rescue mode when GRUB isn't usable. IMIDC cloud VPS plans include a VNC console for this kind of emergency recovery. For remote control or rescue needs on dedicated servers, submit a ticket through the Client Center; our technical team responds 24/7.